CmpFinishSystemHivesLoad
VOID __stdcall CmpFinishSystemHivesLoad(PVOID StartContext){
char v2;
UINT64 *v3;
_CHILD_LIST *v4;
const WCHAR *v5;
__int64 v6;
__int16 v7;
signed __int64 v8;
__int16 Buffer;
_CHILD_LIST *v10;
struct _PRIVILEGE_SET *v11;
_KWAIT_BLOCK *v12;
UINT8 v13;
struct _PRIVILEGE_SET *v14;
VOID **v15;
__int64 *v16;
_QWORD *v17;
__int64 v18;
char v19;
__int64 *v20;
unsigned int i;
WCHAR *v22;
_CMHIVE *v23;
__int64 v24;
struct _LOOKASIDE_LIST_EX *v25;
int v26;
_QWORD *v27;
_QWORD *v28;
EVENT_DESCRIPTOR *v29;
PVOID v30;
VOID *v31;
WCHAR *v32;
WCHAR *v33;
WCHAR *v34;
WCHAR *v35;
unsigned int v36;
__int64 *v37;
char v38;
VOID *v39;
unsigned int v40;
ULONG_PTR *v41;
WCHAR *v42;
UNICODE_STRING *Timeout;
PLARGE_INTEGER Timeouta;
WCHAR **Alertable;
UINT64 Alertablea;
PLARGE_INTEGER v47;
PKWAIT_BLOCK WaitBlockArray;
UNICODE_STRING DestinationString;
char *v50;
size_t pcchDest;
wchar_t *ppszDest;
void *KeyHandle;
PVOID P;
PPRIVILEGE_SET Privileges;
PPRIVILEGE_SET v56;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
_KAPC_STATE ApcState;
INT64 result[54];
char v60;
v2 = 0;
KeyHandle = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset(&ApcState, 0, sizeof(ApcState));
memset((INT64)result, 0i64);
CmpMountThread = (__int64)KeGetCurrentThread();
BYTE1(NlsMbCodePageTag) = 0;
DestinationString.Buffer = (wchar_t *)0x800000;
ppszDest = 0i64;
pcchDest = 0i64;
v50 = &v60;
if( (int)RtlUnicodeStringValidateDestWorker(
(UNICODE_STRING *)&DestinationString.Buffer,
&ppszDest,
&pcchDest,
v3,
Timeout,
Alertable,
(UINT64 *)&v47->QuadPart,
(UINT64)WaitBlockArray) < 0 )
{
Buffer = (__int16)DestinationString.Buffer;
}
else
{
v4 = (_CHILD_LIST *)pcchDest;
v5 = L"\\REGISTRY\\";
v6 = 0x7FFFi64;
v7 = 0;
if( pcchDest )
{
v8 = (char *)ppszDest - (char *)L"\\REGISTRY\\";
do
{
if( !v6 )
break;
if( !*v5 )
break;
*(const WCHAR *)((char *)v5 + v8) = *v5;
--v6;
++v5;
++v7;
}
while( (unsigned int *)((char *)&v4[-4096].Count + v6 + 1) );
}
Buffer = 2 * v7;
LOWORD(DestinationString.Buffer) = Buffer;
}
CmpAllocateTransientPoolWithTag((_HHIVE *)0x200, 0x150ui64, 0x20204D43ui64, v4);
Privileges = v11;
v12 = (_KWAIT_BLOCK *)v11;
if( !v11 )
KeBugCheckEx(0x74u, 2ui64, 4ui64, 0i64, 0xFFFFFFFFC000009Aui64);
CmpAllocateTransientPoolWithTag((_HHIVE *)0x200, 0x38ui64, 0x20204D43ui64, v10);
v56 = v14;
v15 = (VOID **)v14;
if( !v14 )
KeBugCheckEx(0x74u, 2ui64, 6ui64, 0i64, 0xFFFFFFFFC000009Aui64);
P = CmpHiveRootSecurityDescriptor(v13);
v16 = qword_140C00F58;
v17 = v15;
v18 = 7i64;
do
{
*v17 = v16;
v16 += 25;
++v17;
--v18;
}
while( v18 );
if( !StartContext )
{
KeWaitForSingleObject(&stru_140C011B0, Executive, 0, 0, 0i64);
KeSetEvent(&stru_140C011B0, 0);
KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
CmpInitCmRM(0i64, CmpInitRmLogOnLoad);
KiUnstackDetachProcess(&ApcState, 0i64);
if( CmRmSystem )
{
TmEnableCallbacks(*((PKRESOURCEMANAGER *)CmRmSystem + 7), (PTM_RM_NOTIFICATION)CmKtmNotification, CmRmSystem);
CmRmFinalizeRecovery((__int64)CmRmSystem);
}
}
while( 2 )
{
KeWaitForMultipleObjects((_BYTE *)7, v15, WaitAny, Executive, 0, 0, 0i64, v12);
v19 = 0;
v20 = &qword_140C00F30;
for( i = 0; i < 7; ++i )
{
if( *((_BYTE *)v20 + 8) )
goto LABEL_54;
if( !*((_BYTE *)v20 + 9) )
{
v19 = 1;
goto LABEL_54;
}
v22 = (WCHAR *)*(v20 - 5);
LOWORD(DestinationString.Buffer) = Buffer;
RtlAppendUnicodeToString((UNICODE_STRING *)&DestinationString.Buffer, v22);
RtlAppendUnicodeToString((UNICODE_STRING *)&DestinationString.Buffer, (PWCHAR)*(v20 - 4));
CmpLockRegistryExclusive();
if( !*(v20 - 3) )
{
if( !*v20 )
goto LABEL_32;
LOBYTE(v25) = *((_BYTE *)v20 + 11);
LODWORD(Timeouta) = *((_DWORD *)v20 - 2);
v26 = CmpLinkHiveToMaster(
(_UNICODE_STRING *)&DestinationString.Buffer,
0i64,
(_CMHIVE *)*v20,
(INT64)v25,
(UINT64)Timeouta,
0,
0i64,
P,
0i64,
0i64,
1u);
if( v26 < 0 )
{
if( (CmpShutdownRundown & 1) == 0 )
KeBugCheckEx(0x73u, 1ui64, v26, i, (ULONG_PTR)&DestinationString.Buffer);
CmpLoadingSystemHivesActive = 0;
CmpMountThread = 0i64;
CmpUnlockRegistry();
v36 = 0;
v37 = &qword_140C00F38;
do
{
if( *((_DWORD *)v37 + 3) && !*(_BYTE *)v37 )
{
if( !*((_BYTE *)v37 + 1) )
KeWaitForSingleObject(v37 + 4, Executive, 0, 0, 0i64);
ExAcquirePushLockExclusiveEx((UINT64)(v37 + 10), 0i64);
KeSetEvent((PRKEVENT)(v37 + 7), 0);
CmpNotifyMachineHiveLoaded(v36);
ExReleasePushLockEx((UINT64)(v37 + 10), 0i64);
}
++v36;
v37 += 25;
}
while( v36 < 7 );
goto LABEL_80;
}
ExAcquirePushLockExclusiveEx((UINT64)&CmpHiveListHeadLock, 0i64);
v27 = (_QWORD *)qword_140D2D918;
v28 = (_QWORD *)(*v20 + 1600);
if( *(__int64 **)qword_140D2D918 != &CmpHiveListHead )
__fastfail(3u);
*v28 = &CmpHiveListHead;
v28[1] = v27;
*v27 = v28;
qword_140D2D918 = (__int64)v28;
ExReleasePushLockEx((UINT64)&CmpHiveListHeadLock, 0i64);
CmpRecheckHiveVolumePolicy(*v20);
if( *((_BYTE *)v20 + 11) )
{
*(_DWORD *)(*v20 + 160) |= 0x20u;
*(_QWORD *)(*v20 + 4208) = KeGetCurrentThread();
CmpUnlockRegistry();
CmpFlushHive(*v20, 4, v29);
CmpLockRegistryExclusive();
*(_DWORD *)(*v20 + 160) &= ~0x20u;
*(_QWORD *)(*v20 + 4208) = 0i64;
}
v30 = CmRmSystem;
if( CmRmSystem )
{
v23 = (_CMHIVE *)*v20;
if( (*(_DWORD *)(*v20 + 160) & 2) == 0 && !*((_QWORD *)v23 + 524) )
{
++*((_DWORD *)CmRmSystem + 16);
*(_QWORD *)(*v20 + 4192) = v30;
}
}
}
if( *v20 )
CmpAddToHiveFileList(*v20, (__int64)v23, v24, v25);
LABEL_32:
*((_BYTE *)v20 + 8) = 1;
if( i != 3 )
{
switch( i )
{
case 2u:
CmpUnlockRegistry();
if( !StartContext )
{
ExAcquirePushLockExclusiveEx((UINT64)(v20 + 11), 0i64);
KeSetEvent((PRKEVENT)(v20 + 8), 0);
v2 = 1;
CmpNotifyMachineHiveLoaded(2ui64);
ExReleasePushLockEx((UINT64)(v20 + 11), 0i64);
if( byte_140C01190 && CmFastBoot )
{
ExpRefreshSystemTime();
PsBootPhaseComplete(v33);
}
CmpSetVersionData();
}
CmpCreatePerfKeys();
goto LABEL_50;
case 1u:
v34 = L"\\Registry\\Machine\\SAM\\SAM";
v35 = L"\\Registry\\Machine\\Security\\SAM";
break;
case 4u:
v34 = (WCHAR *)L"\\Registry\\User\\.Default";
v35 = (WCHAR *)L"\\Registry\\User\\S-1-5-18";
break;
default:
LABEL_49:
CmpUnlockRegistry();
LABEL_50:
if( !StartContext && !v2 )
{
ExAcquirePushLockExclusiveEx((UINT64)(v20 + 11), 0i64);
KeSetEvent((PRKEVENT)(v20 + 8), 0);
CmpNotifyMachineHiveLoaded(i);
ExReleasePushLockEx((UINT64)(v20 + 11), 0i64);
}
goto LABEL_53;
}
CmpLinkKeyToHive(v35, v34);
goto LABEL_49;
}
if( StartContext )
goto LABEL_49;
CmpMountPreloadedHives();
CmpInterlockedFunction(v31);
ExAcquirePushLockExclusiveEx((UINT64)(v20 + 11), 0i64);
KeSetEvent((PRKEVENT)(v20 + 8), 0);
v2 = 1;
CmpNotifyMachineHiveLoaded(3ui64);
ExReleasePushLockEx((UINT64)(v20 + 11), 0i64);
if( !byte_140C010C8 || !CmFastBoot )
goto LABEL_49;
CmpUnlockRegistry();
ExpRefreshSystemTime();
PsBootPhaseComplete(v32);
LABEL_53:
v2 = 0;
LABEL_54:
v20 += 25;
}
if( v19 )
{
v15 = (VOID **)v56;
v12 = (_KWAIT_BLOCK *)Privileges;
continue;
}
break;
}
CmpLockRegistryExclusive();
CmpSpecialBootCondition = 0;
if( BYTE4(NlsMbCodePageTag) || (v38 = 1, CmVEEnabled != 1) )
v38 = 0;
CmpVEEnabled = v38;
CmpUnlockRegistry();
if( StartContext )
{
KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
CmpInitCmRM(0i64, CmpInitRmLogOnLoad);
KiUnstackDetachProcess(&ApcState, 0i64);
if( CmRmSystem )
{
TmEnableCallbacks(*((PKRESOURCEMANAGER *)CmRmSystem + 7), (PTM_RM_NOTIFICATION)CmKtmNotification, CmRmSystem);
CmRmFinalizeRecovery((__int64)CmRmSystem);
}
CmpLockRegistryExclusive();
CmpMountPreloadedHives();
CmpInterlockedFunction(v39);
CmpUnlockRegistry();
v40 = 0;
v41 = &qword_140C00F88;
do
{
ExAcquirePushLockExclusiveEx((UINT64)v41, 0i64);
KeSetEvent((PRKEVENT)v41 - 1, 0);
CmpNotifyMachineHiveLoaded(v40);
ExReleasePushLockEx((UINT64)v41, 0i64);
++v40;
v41 += 25;
}
while( v40 < 7 );
if( CmFastBoot )
{
ExpRefreshSystemTime();
PsBootPhaseComplete(v42);
}
CmpSetVersionData();
}
LODWORD(Alertablea) = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&CmpConfigurationManagerKeyName;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( ZwCreateKey(&KeyHandle, 2ui64, &ObjectAttributes, 0i64, 0i64, Alertablea, 0i64) >= 0 )
ZwClose(KeyHandle);
LABEL_80:
CmpSpecialBootCondition = 0;
CmpLoadingSystemHivesActive = 0;
CmpMountThread = 0i64;
if( StartContext )
KeSetEvent((PRKEVENT)StartContext, 0);
if( P )
ExFreePoolWithTag(P, 0);
CmSiFreeMemory(Privileges);
CmSiFreeMemory(v56);
}Referenced by:
No references.